CVE-2024-57241

MEDIUM NUCLEI

dedecms 5.71sp1 - URL Redirection via GET Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-57241. PoCs published by iSee857, hkl1x. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2024-57241, demonstrating command execution via crafted HTTP requests to an OpenCode server. The script includes session handling and command injection to achieve RCE.

Description

Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection.

Exploits (2)

github WORKING POC 40 stars
by iSee857 · pythonpoc
https://github.com/iSee857/CVE-PoC/tree/main/DedeCms_CVE-2024-57241_RedirectUrl.py

The repository contains a functional exploit for CVE-2024-57241, demonstrating command execution via crafted HTTP requests to an OpenCode server. The script includes session handling and command injection to achieve RCE.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenCode (version not specified)
No auth needed
Prerequisites: Network access to target server · OpenCode service running
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 3 stars
by hkl1x · poc
https://github.com/hkl1x/CVE-2024-57241

This PoC demonstrates an open redirect vulnerability in DEDECMS 5.71SP1 and earlier versions by exploiting a logic error in the CMS that fails to validate GET request inputs. The script reads target URLs from a file and tests for the vulnerability by appending a malicious redirect link.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: DEDECMS 5.71SP1 and earlier
No auth needed
Prerequisites: List of target URLs in a file named 'target.txt'
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

DedeCMS - Open Redirect via download.php
MEDIUMVERIFIEDby 0x_Akoko
Shodan: http.title:"DedeCMS"
FOFA: body="DedeCMS" || body="/plus/download.php"

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0111
EPSS Percentile 61.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (1)
dedecms/dedecms
Published Feb 11, 2025
Tracked Since Feb 18, 2026